如何以编程方式在Azure VM上远程安装.NET 4客户端？

Question

I am prototyping a build of 2008 R2 on Azure. I have working code to deploy the VM, retrieve the x509 certificate, and establish WinRM access to remote Powershell on the deployed VM.

I need to install some pre-reqs for our software. One of those is .NET 4. When I launch this command:

Invoke-Command -ConnectionUri $azUri -Credential $vmCreds -ScriptBlock {start-process -filepath "c:\\installs\\dotNetFx40_Full_x86_x64.exe" -argumentlist "/q /norestart" -wait}

I get this error in the Setup event log:

Windows update could not be installed because of error 2147942405 "Access is denied." (Command line: "wusa.exe "C:\\1112ac1e217ef544ae09\\Windows6.1-KB958488-v6001-x64.msu" /quiet /norestart")

The creds I am using are built using the administrative account created with the VM itself. The file is obtained using FTP via Powershell (I cobbled an FTP function together using .net methods and some googling).

The project I am working on requires that I use one of the clean default images provided by Microsoft, so I can't customize the template ahead of time. Eventually these operations will also be performed by a config management tool such as Chef or Puppet, so I need to be able to do this in a config management style.

I have tried various permutations of this command and this is the closest I've been able to get it to working. I disabled UAC and rebooted as an experiment, which did not change the behavior. My searching so far has revealed other people having this problem, but no adequate solution that fits my scenario.

Answer 1

I've run into this as well and I'm pretty sure the problem is that wusa cannot be invoked remotely:

KB: Windows Update Standalone Installer (WUSA) returns 0x5 ERROR_ACCESS_DENIED when deploying .msu files through WinRM and Windows Remote Shell

The problem stems from the fact that the .NET 4.0 installer has a couple of msu updates that it wants to apply. Because wusa can't be run from a remote command, the whole shebang fails.

EDIT: I did some digging and found an undocumented flag in ParamaterInfo.xml - the SkipMSUInstall flag will bypass the msu installs, negating the wusa calls, resulting in a successful install. I've just run through this on a few hundred servers and it works great. Our security policies don't allow for CredSSP to be used, so I'm copying the install files locally on each server, then using Invoke-Command and Start-Process to run the installs.

Modified powershell snippet below:

$servers = get-Content c:\temp\serverlist.txt

foreach ($server in $servers) {
  $session = New-PSSession -ComputerName $server -Credential $credential
  Invoke-Command -session $session -asJob -scriptBlock {
    Start-Process "C:\Temp\dotNetFx40_Full_x86_x64\setup.exe" -ArgumentList "/passive /norestart /SkipMSUInstall" -Wait -Passthru
    }
  }